Resource exhaustion in eventlet - CVE-2021-21419

Vulnerability identifier: #VU56244

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21419

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling large websocket frames. A remote attacker can trigger resource exhaustion by sending highly compressed data frame and perform a denial of service (DoS) attack.

eventlet
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
Fedora
openEuler
Ubuntu
Red Hat OpenStack Director Deployment Tools
Red Hat OpenStack Director Deployment Tools for IBM Power
Red Hat OpenStack
Red Hat OpenStack for IBM Power
toolbox (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python3-eventlet (Ubuntu package)
python-eventlet (Red Hat package)
python-eventlet
python-hardware (Red Hat package)
python-eventlet-help
python3-eventlet
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
skopeo (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
conmon (Red Hat package)
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
ignition (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironic-lib (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
ironic-images (Red Hat package)

Install updates from vendor's website.

eventlet - update to 0.31.0
Red Hat OpenShift Container Platform - addressed in versions 4.8.2, 4.10.30, 4.12.41
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - addressed in versions 0.12.1-1.rhaos4.8.el8, 0.16.0-2.1.rhaos4.12.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python3-eventlet (Ubuntu package) - addressed in versions 0.25.1-2ubuntu1.1, 0.26.1-0ubuntu1.1, 0.30.0-0ubuntu1.1
python-eventlet (Red Hat package) - addressed in versions 0.25.2-4.el8, 0.25.2-5.el8ost.1, 0.30.2-4.el8ost, 0.30.2-4.el9
python-eventlet - addressed in versions 0.26.0-2.el8, 0.31.0-1.fc33, 0.31.0-1.fc34
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-eventlet-help - update to 0.30.2-2
python3-eventlet - update to 0.30.2-2
python-eventlet - update to 0.30.2-2
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
Migration Toolkit for Containers - update to 1.5.1
skopeo (Red Hat package) - update to 1.9.4-3.1.rhaos4.12.el9
cri-tools (Red Hat package) - addressed in versions 1.21.0-2.el7, 1.21.0-2.el8, 1.25.0-2.1.el8, 1.25.0-2.1.el9
cri-o (Red Hat package) - addressed in versions 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8, 1.25.3-5.1.rhaos4.12.git44a2cb2.el9
buildah (Red Hat package) - addressed in versions 1.23.4-5.1.rhaos4.12.el9, 1.23.4-5.1.1.rhaos4.12.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
conmon (Red Hat package) - update to 2.1.2-6.1.rhaos4.12.el9
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
ignition (Red Hat package) - addressed in versions 2.9.0-6.rhaos4.8.el8, 2.14.0-5.1.rhaos4.12.el9, 2.14.0-6.1.rhaos4.12.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - update to 2.289.1.1624020353-1.el8
podman (Red Hat package) - addressed in versions 3.0.1-6.el8, 4.2.0-6.1.1.rhaos4.12.el8, 4.2.0-7.1.rhaos4.12.el9
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-oslo-log (Red Hat package) - update to 4.4.0-0.20210409081224.9b29c90.el8
python-ironic-lib (Red Hat package) - update to 4.6.2-0.20210608101214.ca2e4ba.el8
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
openshift-kuryr (Red Hat package) - update to 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7, 4.12.0-202310190945.p0.ge8e1e51.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8, 4.12.0-202310180726.p0.ga55beda.assembly.stream.el8, 4.12.0-202310180726.p0.ga55beda.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8, 4.12.0-202310210144.p0.g31e0558.assembly.stream.el8, 4.12.0-202310210144.p0.g31e0558.assembly.stream.el9
jenkins-2-plugins (Red Hat package) - update to 4.8.1624022417-1.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - update to 7.0.2-0.20210611153100.bfa97cb.el8
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210713221218.a415e7e.el8
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4
ironic-images (Red Hat package) - update to 2021.1-20210614.1.el8

• https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L/

• Denial of service in Eventlet
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Red Hat OpenStack update for Eventlet
• Ubuntu update for python-eventlet
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Red Hat OpenStack Platform 17.1 update for python-eventlet
• openEuler 20.03 LTS SP3 update for python-eventlet
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages
• Fedora 34 update for python-eventlet
• Fedora 33 update for python-eventlet
• Fedora EPEL 8 update for python-eventlet